CVE-2026-3502: TrueConf Client download of code without integrity check

CVE-2026-3502 · Severity: critical · CVSS 7.8 · Exploited in the wild · Published 2026-04-02

TrueConf Client, a video conferencing and collaboration tool, contains a security flaw in how it handles software updates. The application fails to verify the digital signature or integrity of update files before installing them. An attacker who can intercept or manipulate the network traffic between the user and the update server can replace a legitimate update with malicious software. This could allow an attacker to take full control of the user's computer, potentially leading to data theft or unauthorized access to corporate communications.

Technologies: Trueconf Client. Vendors: Trueconf.

Quick answers

Is CVE-2026-3502 exploited in the wild?
Yes. CVE-2026-3502 is known to be exploited in the wild, first recorded on 2 April 2026. Treat it as urgent.
How severe is CVE-2026-3502?
Critical severity, with a CVSS score of 7.8, published 2 April 2026.
Which products and versions are affected?
Trueconf Client versions up to (excluding) 8.5.3.884.
Is there a fix for CVE-2026-3502?
A patch was published on 2026-04-03: NIST analysis confirms patch in version 8.5.3.884. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-3502 attacked?
It is attacked from the adjacent network, in a network appliance.
Am I affected by CVE-2026-3502?
Check whether you run Trueconf Client at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

TrueConf Client is vulnerable to a 'Download of Code Without Integrity Check' (CWE-494). The application downloads update packages but fails to perform cryptographic verification or signature checks before execution. An attacker positioned on the local network or update delivery path can perform a man-in-the-middle (MitM) attack to substitute the legitimate update with a malicious payload. Successful exploitation results in arbitrary code execution in the context of the updater process or the logged-in user. This vulnerability has been observed in active exploitation in the wild. The issue is addressed in TrueConf Client version 8.5.3.884 and later.

Affected products

  • TrueConf TrueConf Client versions up to (excluding) 8.5.3.884

Timeline

  • 2026-03-30: disclosed: Initial disclosure by Check Point Software Technologies Ltd.
  • 2026-03-31: exploited: Reported as being used in 0-day exploitation against Southeast Asian government targets.
  • 2026-04-02: kev added: Added to CISA Known Exploited Vulnerabilities (KEV) catalog.
  • 2026-04-03: patched: NIST analysis confirms patch in version 8.5.3.884.

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.